📅 Original date posted:2013-10-26
📝 Original message:On Fri, Oct 25, 2013 at 08:31:05PM -0700, Gregory Maxwell wrote:
> One limitation of the payment protocol as speced is that there is no
> way for a hidden service site to make use of its full authentication
> capability because they are unable to get SSL certificates issued to
> them.
>
> A tor hidden service (onion site) is controlled by an RSA key.
>
> It would be trivial to pack a tor HS pubkey into a self-signed x509
> certificate with the cn set to foooo.onion.
>
> If we specified in the payment protocol an additional validation
> procedure for [base32].onion hosts that just has it hash and base32
> encode the pubkey (as tor does) then the payment protocol could work
> seamlessly with tor hosts. (Displaying that the payment request came
> from "foooo.onion"). I believe that the additional code for this
> would be trivial (and I'll write it if there is support for making
> this a standard feature).
>
> This would give us an fully supported option which is completely CA
> free... it would only work for tor sites, but the people concerned
> about CA trechery are likely to want to use tor in any case.
>
> Thoughts?
Strong ACK on the basis of responding for forum trolls alone.
It's easy enough to make it a genuinely useful tool for multisig wallets
too: keep a copy of your Tor URL bookmarks on your second signing
computer. So long as either computer has the correct URL you're safe.
--
'peter'[:-1]@petertodd.org
0000000000000006fbd917e8b4770c566dbc8ed4bedd00f441286ffb6e7f73ac
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 685 bytes
Desc: Digital signature
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20131026/c214a3f2/attachment.sig>;
Peter Todd [ARCHIVE] /
npub1m2…a2np2
2023-06-07 15:08:18
in reply to nevent1q…fymj
Author Public Key
npub1m230cem2yh3mtdzkg32qhj73uytgkyg5ylxsu083n3tpjnajxx4qqa2np2Seen on
wss://relay.noswhere.comPublished at
2023-06-07 15:08:18Event JSON
{
"id": "76c077077b6ff914dcd20a7044383ce5c11e78e8ba18214ff1b2959a92a9b959",
"pubkey": "daa2fc676a25e3b5b45644540bcbd1e1168b111427cd0e3cf19c56194fb231aa",
"created_at": 1686150498,
"kind": 1,
"tags": [
[
"e",
"742033471721f40b6d43cf4cd64612772c20a2675cdda10846c302155fc1bb24",
"",
"root"
],
[
"e",
"673a81974d68da7cfeddc46aa51cb0da4ae96d9460d5bde134d15da55ca6f0e5",
"",
"reply"
],
[
"p",
"857f2f78dc1639e711f5ea703a9fc978e22ebd279abdea1861b7daa833512ee4"
]
],
"content": "📅 Original date posted:2013-10-26\n📝 Original message:On Fri, Oct 25, 2013 at 08:31:05PM -0700, Gregory Maxwell wrote:\n\u003e One limitation of the payment protocol as speced is that there is no\n\u003e way for a hidden service site to make use of its full authentication\n\u003e capability because they are unable to get SSL certificates issued to\n\u003e them.\n\u003e \n\u003e A tor hidden service (onion site) is controlled by an RSA key.\n\u003e \n\u003e It would be trivial to pack a tor HS pubkey into a self-signed x509\n\u003e certificate with the cn set to foooo.onion.\n\u003e \n\u003e If we specified in the payment protocol an additional validation\n\u003e procedure for [base32].onion hosts that just has it hash and base32\n\u003e encode the pubkey (as tor does) then the payment protocol could work\n\u003e seamlessly with tor hosts. (Displaying that the payment request came\n\u003e from \"foooo.onion\"). I believe that the additional code for this\n\u003e would be trivial (and I'll write it if there is support for making\n\u003e this a standard feature).\n\u003e \n\u003e This would give us an fully supported option which is completely CA\n\u003e free... it would only work for tor sites, but the people concerned\n\u003e about CA trechery are likely to want to use tor in any case.\n\u003e \n\u003e Thoughts?\n\nStrong ACK on the basis of responding for forum trolls alone.\n\nIt's easy enough to make it a genuinely useful tool for multisig wallets\ntoo: keep a copy of your Tor URL bookmarks on your second signing\ncomputer. So long as either computer has the correct URL you're safe.\n\n-- \n'peter'[:-1]@petertodd.org\n0000000000000006fbd917e8b4770c566dbc8ed4bedd00f441286ffb6e7f73ac\n-------------- next part --------------\nA non-text attachment was scrubbed...\nName: signature.asc\nType: application/pgp-signature\nSize: 685 bytes\nDesc: Digital signature\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20131026/c214a3f2/attachment.sig\u003e",
"sig": "e0e34a8b8c18de00361a950352781a4011c80d6a3378c49a3e181a89ccfe21477e8258c299b8c90f0b5b02044d4dfd35b6618411bf124ba9e93865e13344468f"
}